Information inquiry system and information inquiry method

Abstract

To safely disclose appropriate information corresponding to presence / absence of consciousness of a user.SOLUTION: When determining that verification of consciousness confirmation information indicating that a user is conscious is successful and that biometric authentication based on biometric information of the user between a terminal and a server is successful, the server transmits disclosure target information that is authorized to be disclosed when the user is conscious to the terminal. When not determining that the verification of consciousness confirmation information is successful but determining that the first biometric authentication and biometric authentication of a proxy based on the biometric information of the proxy between the terminal and the server are successful, the server transmits disclosure target information having authority to be disclosed when the user is unconscious to the terminal.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information inquiry system and an information inquiry method. [Background technology]

[0002] Background of the present invention is JP 2004-357843 A (Patent Document 1). This publication states that "a command center stores a database of emergency information such as a citizen's medical history, medication status, and undesired treatment methods, fingerprint information of the citizen, fingerprint information of the ambulance crew and doctors who will view the emergency information, and doctors on duty at emergency designated hospitals and their medical fields. Based on the patient's fingerprint, the database is obtained for the patient's emergency information. Based on the ambulance crew's fingerprint, it is checked whether the ambulance crew has the right to view the emergency information. Also, based on the fingerprint of a doctor who is resident at the command center or a doctor outside the command center, it is checked whether the doctor has the right to view the emergency information. The doctor who has the right to view the emergency information then views the patient's emergency information and instructs the ambulance crew who also has the right to view it to perform the most appropriate life-saving treatment for the patient and the hospital to which the patient should be transported" (see abstract). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2004-357843 A Summary of the Invention [Problem to be solved by the invention]

[0004] In the technology described in Patent Document 1, the right of emergency personnel and doctors to view emergency information of citizens (users) is not considered whether the citizen is conscious or not. For users, the information that they may disclose may differ depending on whether they are conscious or not. Therefore, one aspect of the present invention safely discloses appropriate information according to the user's consciousness or not. [Means for solving the problem]

[0005] In order to solve the above problem, one aspect of the present invention employs the following configuration: In an information inquiry system including a terminal and a server, the server holds disclosure target information of a user and authority information indicating the authority to receive disclosure according to the user's consciousness for each type of the disclosure target information, the terminal acquires first biometric information of the user and acquires second biometric information of an agent, the server receives from the terminal a data acquisition request based on consciousness confirmation information indicating that the user is conscious, and when the server determines that verification of the consciousness confirmation information has been successful based on the data acquisition request and that first biometric authentication of the user based on the first biometric information between the terminal and the server has been successful, transmits to the terminal information included in the disclosure target information and that the user has the authority to receive disclosure when the user is conscious, as indicated by the authority information, and when the server determines that the first biometric authentication and the second biometric authentication of the agent based on the second biometric information between the terminal and the server have been successful without determining that verification of the consciousness confirmation information has been successful, transmits to the terminal information included in the disclosure target information and that the user has the authority to receive disclosure when the user is unconscious, as indicated by the authority information. Effect of the Invention

[0006] According to one aspect of the present invention, it is possible to safely disclose appropriate information depending on whether or not a user is aware of the information.

[0007] Problems, configurations and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0008] [Figure 1] 1 is a block diagram showing a configuration example of an information inquiry system according to a first embodiment. [Diagram 2] 2 is a block diagram showing an example of a hardware configuration of each device included in the information inquiry system according to the first embodiment. FIG. [Diagram 3]11 is a flowchart showing an example of a user information registration process included in the initial registration process in the first embodiment. [Figure 4] 13 is a flowchart showing an example of a paramedic information registration process included in the initial registration process in the first embodiment. [Diagram 5] 13 is a flowchart showing an example of a user medical information registration process included in the initial registration process in the first embodiment. [Figure 6A] FIG. 11 is an explanatory diagram showing an example of a screen transition when authority is transferred using a standard classification in the first embodiment. [Figure 6B] FIG. 11 is an explanatory diagram showing an example of a screen transition when authority is transferred using a standard classification in the first embodiment. [Figure 6C] FIG. 11 is an explanatory diagram showing an example of a screen transition when information is individually selected and authority is transferred in the first embodiment. [Figure 7] FIG. 11 is a sequence diagram showing an example of an information inquiry process when a user (injured person) is conscious in an emergency in the first embodiment. [Figure 8A] FIG. 11 is a sequence diagram showing an example of an information inquiry process in which a user (injured person) is unconscious in an emergency in the first embodiment. [Figure 8B] FIG. 11 is a sequence diagram showing an example of an information inquiry process in which a user (injured person) is unconscious in an emergency in the first embodiment. [Figure 9A] FIG. 11 is an explanatory diagram showing an example of a screen transition of an authority transfer registration content confirmation screen in the first embodiment. [Figure 9B] FIG. 11 is an explanatory diagram showing an example of a screen transition of an authority transfer registration content confirmation screen in the first embodiment. [Figure 9C] FIG. 11 is an explanatory diagram showing an example of a screen transition of an information presentation consent screen in the first embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. In this embodiment, the same components are generally designated by the same reference numerals, and repeated explanations are omitted. Note that this embodiment is merely an example for realizing the present invention, and does not limit the technical scope of the present invention. EXAMPLES

[0010] 1 is a block diagram showing an example of the configuration of an information inquiry system. The information inquiry system includes a terminal 100, a user information management server 200, a paramedic information management server 300, and a medical information management server 400, which are connected via a network such as the Internet.

[0011] The terminal 100 includes, for example, a UID acquisition unit 101, a PIN (Personal Identification Number) acquisition unit 102, a biometric information acquisition unit 103, a key generation unit 104, a public key certificate generation unit 105, a registration request unit 106, an authority transfer registration unit 107, a data acquisition request unit 108, an authentication unit 109, and a signature unit 110, all of which are functional units.

[0012] The UID acquisition unit 101 acquires a UID that is an ID that uniquely identifies an individual. The PIN acquisition unit 102 acquires a PIN. The biometric information acquisition unit 103 acquires biometric information. The key generation unit 104 generates a key pair of a public key and a private key from the biometric information by the biometric information acquisition unit 103.

[0013] The public key certificate generation unit 105 generates a public key certificate corresponding to the key pair generated by the key generation unit 104. The registration request unit 106 requests registration of information from the user information management server 200, the paramedic information management server 300, and the medical information management server 400. The authority transfer registration unit 107 registers information regarding the authority to receive disclosure of information to be disclosed, including the user's medical information, qualification information, etc. (and information regarding the transfer of the authority to receive the disclosure).

[0014] The data acquisition request unit 108 requests data acquisition from the user information management server 200 and the paramedic information management server 300. The authentication unit 109 executes authentication between the terminal 100 and the user information management server 200, and between the terminal 100 and the paramedic information management server 300. The signature unit 110 affixes a signature to data received from the user information management server 200.

[0015] The user information management server 200 includes, for example, a data management unit 201, a PIN verification unit 202, and an authentication unit 203, which are all functional units. The user information management server 200 also holds, for example, one or more wallets 221.

[0016] The data management unit 201 manages data held by the user information management server 200. The PIN verification unit 202 verifies the PIN received from the terminal 100. The authentication unit 203 executes authentication between the terminal 100 and the user information management server 200. Each wallet 221 is linked to a user's UID and holds data such as medical information of the user. In other words, the wallet 221 is a data storage area on an auxiliary storage device, determined for each user, for storing data registered in the user information management server 200 from the terminal 100, data registered in the user information management server 200 from the medical information management server 400, and the like.

[0017] The paramedic information management server 300 includes, for example, a data management unit 301 and an authentication unit 302, both of which are functional units. The paramedic information management server 300 also holds, for example, one or more wallets 321.

[0018] The data management unit 301 manages data held by the paramedic information management server 300. The authentication unit 302 executes authentication between the terminal 100 and the paramedic information management server 300. Each wallet 321 is linked to the UID of a paramedic and holds data such as information on the paramedic. In other words, the wallet 321 is a data storage area on an auxiliary storage device, which is determined for each paramedic, for storing data registered in the paramedic information management server 300 from the terminal 100. In this embodiment, the paramedic is also simply referred to as a paramedic. The paramedic is an example of an agent who queries the user's information from the user information management server 200 on behalf of the user.

[0019] The medical information management server 400 includes, for example, a data management unit 401 and an electronic certificate verification unit 402, both of which are functional units. The medical information management server 400 also holds, for example, qualification data 421 and medical data 422.

[0020] The data management unit 401 manages data held by the medical information management server 400. The electronic certificate verification unit 402 verifies the electronic certificate transmitted from the terminal 100. The qualification data 421 indicates qualification information of the health insurance to which the user is enrolled, etc. The medical data 422 indicates information related to the medical care of the user.

[0021] Some of the devices included in the information inquiry system may be integrated. Specifically, for example, the user information management server 200 and the paramedic information management server 300 may be integrated. Communication and authentication between the integrated devices may be omitted. Also, the paramedic information management server 300 and the medical information management server 400 may not be connected.

[0022] Furthermore, the information inquiry system may include a plurality of terminals 100. In this case, for example, each of the user and the paramedic may have a terminal 100 such as a smartphone or a tablet.

[0023] Furthermore, the terminal 100 may be divided into a registration terminal used for an initial registration process described later, and a reference terminal used for an information reference process described later. In this case, for example, the registration terminal may be a portable terminal such as a smartphone or tablet, since it is used for the initial registration, or may be a dedicated stationary terminal installed in a specific location. The reference terminal may be a portable terminal such as a smartphone or tablet, since it is used in an emergency.

[0024] For example, the registration terminal includes functional units 101, 102, 103, 104, 105, 106, and 107, which respectively execute processes included in the initial registration process, and the inquiry terminal includes 103, 104, 108, 109, and 110, which respectively execute processes included in the information inquiry process.

[0025] 2 is a block diagram showing an example of the hardware configuration of each device included in the information inquiry system. Each of the terminal 100, the user information management server 200, the paramedic information management server 300, and the medical information management server 400 is configured by a computer 500 having, for example, a CPU (Central Processing Unit) 501, a memory 502, an auxiliary storage device 503, an input device 504, a display device 505, and a communication device 506. The computer 500 configuring the terminal 100 may further include a biosensor 507 and an IC (Integrated Circuit) card reader 508.

[0026] CPU 501 includes a processor and executes programs stored in memory 502. Memory 502 includes ROM (Read Only Memory), which is a non-volatile storage element, and RAM (Random Access Memory), which is a volatile storage element. ROM stores immutable programs (e.g., BIOS (Basic Input / Output System)) and the like. RAM is a high-speed, volatile storage element such as DRAM (Dynamic Random Access Memory), and temporarily stores programs executed by CPU 501 and data used when the programs are executed.

[0027] The auxiliary storage device 503 is a large-capacity non-volatile storage device such as a magnetic storage device (HDD (Hard Disk Drive)) or a flash memory (SSD (Solid State Drive)), and stores programs executed by the CPU 501 and data used when the programs are executed. That is, the programs are read from the auxiliary storage device 503, loaded into the memory 502, and executed by the CPU 501.

[0028] The input device 504 is a device such as a keyboard or a mouse that receives input from an operator. The display device 505 is a device such as a display or a printer that outputs the results of program execution in a format that can be visually recognized by the operator. Note that the input device 504 and the display device 505 may be integrated into one device, such as a touch panel.

[0029] The communication device 506 is a network interface device that controls communication with other devices in accordance with a predetermined protocol, and includes a serial interface such as a Universal Serial Bus (USB).

[0030] The biometric sensor 507 is a sensor for acquiring a predetermined type of biometric information. The predetermined type of biometric information is preferably biometric information that can be acquired by another person without the user's awareness, and includes, for example, an image or a video of a part of the body such as a face, a hand (palm print, veins), or a finger (fingerprint, veins) captured with light of any predetermined wavelength such as visible light, infrared light, near-infrared light, or X-rays.

[0031] During emergency transport, it is expected that the user may have an injury to the hand or finger, making it impossible to obtain veins or fingerprints, or that the user may be unconscious with his / her eyes closed, making it impossible to obtain irises, etc., so it is desirable for the biometric sensor 507 to be able to obtain multiple types of biometric information. In this case, biometric authentication may be performed using one type of biometric information out of the multiple types of biometric information.

[0032] The IC card reader 508 reads information from an IC built into an IC card. Instead of the IC card reader 508, the computer 500 constituting the terminal 100 may have a built-in function of reading information from an IC built into an IC card by short-range wireless communication.

[0033] A part or all of the programs executed by the CPU 501 may be provided to the computer 500 from a removable medium (such as a CD-ROM or a flash memory) which is a non-transitory storage medium, or from an external computer equipped with a non-transitory storage device via a network, and may be stored in a non-volatile auxiliary storage device 503 which is a non-transitory storage medium. For this reason, the computer 500 may have an interface for reading data from the removable medium.

[0034] Each device included in the information query system is a computer system configured on one physical computer 500, or on multiple logically or physically configured computers 500, and may operate in separate threads on the same computer 500, or may operate on a virtual computer constructed on multiple physical computer resources.

[0035] The above-mentioned functional units of each device included in the information inquiry system are included in a CPU 501 of a computer 500 constituting the device. For example, the CPU 501 of the computer 500 constituting the terminal 100 functions as a UID acquisition unit 101 by operating according to a UID acquisition program loaded in a memory 502 of the computer 500, and functions as a PIN acquisition unit 102 by operating according to a PIN acquisition program loaded in the memory 502 of the computer 500. The relationship between the CPU 501, the programs, and the functional units is similar for the other functional units of the terminal 100. The relationship between the CPU 501, the programs, and the functional units is also similar for the functional units of the user information management server 200, the paramedic information management server 300, and the medical information management server 400.

[0036] In addition, some or all of the functions of the functional units of each device included in the information inquiry system may be realized by hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array).

[0037] The auxiliary storage device 503 of the computer 500 constituting the user information management server 200 holds the wallet 221. The auxiliary storage device 503 of the computer 500 constituting the paramedic information management server 300 holds the wallet 321. The auxiliary storage device 503 of the computer 500 constituting the medical information management server 400 holds the qualification data 421 and medical data 422.

[0038] In addition, some or all of the information held by each device included in the information inquiry system may be stored in memory 502 of the computer 500 that constitutes the device, or may be stored in an external database connected to the device.

[0039] In this embodiment, the information used by the information inquiry system does not depend on the data structure and may be expressed in any data structure. For example, the information may be stored in a data structure appropriately selected from a table, a list, a database, or a queue.

[0040] Hereinafter, the initial registration process for registering user information, paramedic information, and user's medical information will be described with reference to Figures 3 to 5. Although an example in which the user and the paramedic use different terminals 100 will be described in Figures 3 to 5, the same terminal 100 may be used.

[0041] 3 is a flowchart showing an example of a user information registration process included in the initial registration process. The UID acquisition unit 101 of the terminal 100 generates a UID that uniquely identifies an individual user (S301).

[0042] Specifically, for example, the UID acquiring unit 101 may acquire a UID by accepting an input of the UID from a user via the input device 504 of the computer 500 constituting the terminal 100, or the UID acquiring unit 101 may acquire a UID by automatically generating a UID. Note that, in order to prevent the same UID from being assigned to different individuals, the UID acquiring unit 101 may inquire of the user information management server 200 as to whether there is a UID that overlaps with the acquired UID, or may acquire a UID by requesting the user information management server 200 to generate a UID.

[0043] The PIN acquisition unit 102 acquires a PIN (S302). Specifically, for example, the PIN acquisition unit 102 acquires a PIN by accepting input of the PIN from the user via the input device 504 of the computer 500 constituting the terminal 100. Note that the PIN is an example of information (consciousness confirmation information) for confirming whether the user is conscious in the information inquiry process, and the user's voice or the like may be used as the consciousness confirmation information instead of or in addition to the PIN.

[0044] The biometric information acquiring unit 103 acquires biometric information for registration of the user via the biometric sensor 507 of the computer 500 constituting the terminal 100 (S303).

[0045] The key generation unit 104 generates a key pair of a private key and a public key from the biometric information acquired in step S303 using a predetermined algorithm (S304). RSA, DSA (Digital Signature Algorithm), etc. are examples of the predetermined algorithm. Fuzzy Extractor, Fuzzy Signature, etc. are also examples of the predetermined algorithm. However, when using an algorithm such as Fuzzy Extractor, the key generation unit 104 generates auxiliary information in addition to the key pair, and the generated auxiliary information is used to generate a private key in the information inquiry process described later.

[0046] The public key certificate generating unit 105 generates a public key certificate (S305). The public key certificate is a certificate generated by adding a biometric signature to a public key included in a key pair, and is used for signature verification (self-signature verification) using a private key generated from biometric information. In step S305, the public key certificate generating unit 105 may generate a self-signed certificate as a public key certificate based on the private key generated in step S304, for example, or may obtain a public key certificate from a certification authority connected to the terminal 100.

[0047] The registration request unit 106 transmits the UID acquired in step S301, the PIN acquired in step S302, and the public key certificate generated in step S305 to the user information management server 200 (S306).

[0048] The data management unit 201 of the user information management server 200 generates a wallet 221 corresponding to the UID received in step S306, and links the UID, PIN, and public key certificate received in step S306 and registers them in the generated wallet 221 (S307).

[0049] In step S307, the data management unit 201 creates data indexes corresponding to each type of the qualification information and medical information in the wallet 221. The data indexes to be created are, for example, predetermined. Here, the data index is information for identifying the type of data, and the data index of the data included in the qualification data 421 includes, for example, the user's address, name, date of birth, emergency contact, and health insurance number, and the data index of the data included in the medical data 422 includes, for example, the user's family doctor, medication information, illnesses being treated, allergies, and medical history.

[0050] The data management unit 201 notifies the terminal 100 of the registration result in step S307 (S308). The notified registration result may be displayed on the display device 505 of the computer 500 constituting the terminal 100, for example.

[0051] In addition, if auxiliary information is generated in step S304, in step S306, the registration request unit 106 also sends the auxiliary information to the user information management server 200, and in step S307, the data management unit 201 also links the auxiliary information to the UID and registers it in the generated wallet 221.

[0052] Furthermore, in the above example, the PIN is registered in the user information management server 200, but in a situation where the terminal 100 used by the user for the initial registration process can also be used for the information inquiry process, for example, when each user owns a terminal 100, the PIN may be registered in the auxiliary storage device 503 of the terminal 100. In this case, the PIN does not need to be transmitted to the user information management server 200 in step S306, and the PIN does not need to be registered in the wallet 221 in step S307.

[0053] As described above, it is preferable that the biometric information acquisition unit 103 acquires multiple types of biometric information of the user. In this case, the processes of steps S304 and S305 are executed for each of the multiple types of biometric information, a public key certificate corresponding to each of the multiple types of biometric information is transmitted in step S306, and the public key certificate corresponding to each of the multiple types of biometric information is associated with a UID and registered in the wallet 221 in step S307.

[0054] The authority transfer registration unit 107 acquires information (authority transfer information) regarding the transfer of authority to receive disclosure of information in the case where the user is unconscious during an emergency, via an input from the user to the input device 504 (S309). In step S309, an authority transfer information registration screen, which will be described later, is displayed on the display device 505 of the computer 500 constituting the terminal 100, and the authority transfer information is acquired via the authority transfer information registration screen.

[0055] Although details will be described later, if the user is unconscious during an emergency, the user cannot consent to the disclosure of medical information, etc., of his / her own will, during the information inquiry process. Therefore, by registering authority transfer information indicating prior consent to the disclosure of medical information, etc., in advance, it is possible to disclose some or all of the medical information, etc. to a paramedic, etc., even if the user is unconscious during an emergency.

[0056] The authority transfer information indicates the authority to receive disclosure according to the consciousness or unconsciousness of the user for each type of data (data index). Specifically, for example, the authority transfer information indicates information that can be disclosed only when the user is conscious (i.e., information that only the user has the authority to receive disclosure), information that can be disclosed only when the disclosure conditions are met (even if the user is unconscious during an emergency) (i.e., information for which the authority to receive disclosure is transferred from the user when the disclosure conditions are met), and information that can be disclosed if the user and the paramedic are in the same place (even if the user is unconscious during an emergency) (information that not only the user but also the paramedic have the right to receive disclosure).

[0057] The disclosure conditions include, for example, conditions regarding the user's symptoms during an emergency and conditions regarding the person to whom the authority to receive disclosure is transferred. In other words, for example, in the case where the user is unconscious during an emergency, the user's medical information, etc. is disclosed to a degree according to at least one of the user's symptoms and the person requesting (agreeing to) the disclosure (of the user's medical information).

[0058] The authority transfer registration unit 107 transmits the authority transfer information acquired in step S309 to the user information management server 200 (S310). The data management unit 201 of the user information management server 200 links the authority transfer information received in step S310 to the UID and registers it in the wallet 221 generated in step S307 (S311). Note that in step S311, the authority transfer information registered in step S311 (information on the authority to be disclosed indicated by the authority transfer information) is associated with each data index of the wallet 221 and registered.

[0059] For a certain type of data, the disclosure conditions may be predefined without requiring the input of authority transfer information. Specifically, for example, for the types of data, such as the user's name, date of birth, address, emergency contact information, family doctor, illness being treated, commonly used medication, and allergies, the disclosure conditions may be predefined such that the data may be disclosed to a paramedic if the user is unconscious.

[0060] The data management unit 201 notifies the terminal 100 of the registration result in step S311 (S312). The key generation unit 104 of the terminal 100 deletes the private key of the key pair generated in step S304 (S313).

[0061] 4 is a flowchart showing an example of the paramedic information registration process included in the initial registration process. The UID acquisition unit 101 of the terminal 100 generates a UID that uniquely identifies each paramedic (S401). The method of acquiring the UID in step S401 is the same as the method of acquiring the UID in step S301. However, if the user information management server 200 and the paramedic information management server 300 are integrated, the paramedic's UID needs to be set so that it does not overlap with the UID of either the user or the paramedic.

[0062] The biometric information acquisition unit 103 acquires biometric information for registration of the paramedic via the biometric sensor 507 of the computer 500 constituting the terminal 100 (S402). The type of biometric information for registration of the user and the type of biometric information for registration of the paramedic may be the same or different.

[0063] The key generating unit 104 generates a key pair of a private key and a public key from the biometric information acquired in step S402 using a predetermined algorithm (S403). The method of generating the key pair in step S403 is the same as the method of generating the key pair in step S304, except that the biometric information for registration of the paramedic is used.

[0064] The public key certificate generating unit 105 generates a public key certificate (S404). The method of generating the public key certificate in step S404 is the same as the method of generating the public key certificate in step S304, except that the public key certificate is a public key certificate for the paramedic's key pair.

[0065] The registration request unit 106 transmits the UID acquired in step S401 and the public key certificate generated in step S404 to the paramedic information management server 300 (S405). The data management unit 301 of the paramedic information management server 300 generates a wallet 321 corresponding to the UID received in step S405, associates the UID and the public key certificate received in step S405, and registers them in the generated wallet 321 (S406). The data management unit 301 notifies the terminal 100 of the registration result in step S406 (S407). The notified registration result may be displayed, for example, on the display device 505 of the computer 500 constituting the terminal 100. The key generation unit 104 of the terminal 100 deletes the private key of the key pair generated in step S403 (S408).

[0066] In addition, if auxiliary information is generated in step S403, in step S405, the registration request unit 106 also transmits the auxiliary information to the paramedic information management server 300, and in step S406, the data management unit 301 links the auxiliary information to the UID and registers it in the generated wallet 321.

[0067] In addition, in the paramedic information registration process, as in the user information registration process, a PIN for the paramedic may be set and stored in the wallet 321. In addition, in the paramedic information registration process, data such as the paramedic's name and qualifications may also be registered in the wallet 321 (a data index corresponding to the data is created and linked to the data index).

[0068] 5 is a flowchart showing an example of a user medical information registration process included in the initial registration process. The registration request unit 106 reads information from the IC chip of the user's My Number card via the IC card reader 508 of the computer 500 constituting the terminal 100 (S501). The IC chip of the My Number card stores an electronic certificate for user authentication.

[0069] The registration request unit 106 accepts input of a PIN for retrieving the user-authentic electronic certificate stored in the IC chip of the My Number card (S502) via the input device 504 of the computer 500 constituting the terminal 100. When the correct PIN is input, the registration request unit 106 can retrieve the user-authentic electronic certificate from the IC chip.

[0070] The registration request unit 106 transmits the extracted user-certificate electronic certificate to the medical information management server 400 (S503). The electronic certificate verification unit 402 of the medical information management server 400 verifies the user-certificate electronic certificate received in step S503, and if the verification is successful, the data management unit 401 obtains the user's qualification information indicated by the user-certificate electronic certificate from the qualification data 421, obtains the user's medical information from the medical data 422, and transmits the obtained qualification information and medical information to the user information management server 200 (S504).

[0071] The data management unit 201 of the user information management server 200 links each type of qualification information and medical information (an example of information to be disclosed) received in step S504 to a data index of that type and stores it in the wallet 221 of that user (S505).

[0072] In addition, the wallet 221 of the user, which is the storage destination of the qualification information and medical information in step S505, is identified by, for example, the UID acquired in step S307 when the user medical information registration process of Fig. 5 is executed continuing from the user information registration process of Fig. 3. On the other hand, when the user medical information registration process of Fig. 5 is executed without continuing from the user information registration process of Fig. 3, for example, the terminal 100 may accept input of the user's UID and PIN and transmit the UID and the PIN to the user information management server 200 before the process of step S505, so that the wallet 221 corresponding to the UID and the PIN may be identified as the wallet 221 of the user in step S505, or 1:N authentication using the user's biometric information similar to steps S808 to S810 described later may be executed before the process of step S505 to identify the user's UID, so that the wallet 221 corresponding to the identified UID may be identified as the wallet 221 of the user in step S505.

[0073] In step S503, registration request unit 106 of terminal 100 may also send the public key generated in step S304 to medical information management server 400, and in step S504, data management unit 401 may encrypt the acquired qualification information and medical information with the public key and send it to user information management server 200. As a result, encrypted qualification information and medical information are stored in wallet 221, so that even the administrator of user information management server 200 cannot view this information.

[0074] The data management unit 201 notifies the terminal 100 of the registration result in step S505 (S506). The notified registration result may be displayed on the display device 505 of the computer 500 constituting the terminal 100, for example.

[0075] In the example of Figure 5, authentication between terminal 100 and medical information management server 400 is performed using a My Number card, but the My Number card is an example of a medium for performing authentication between terminal 100 and medical information management server 400, and authentication may be performed between terminal 100 and medical information management server 400 using any algorithm.

[0076] In addition, the terminal 100 may request the medical information management server 400 to update the qualification data 421 and medical data 422 in the wallet 221 of the user in the user information management server 200 every time the qualification data 421 and medical data 422 of the user in the medical information management server 400 are updated.

[0077] In this case, for example, when the qualification data 421 and / or medical data 422 of the user in the medical information management server 400 is updated, the processing of steps S504 to S506 is executed for the updated data. Also, for example, when the qualification data 421 and / or medical data 422 of the user in the medical information management server 400 is updated, the medical information management server 400 may notify the terminal 100 of the user that the data will be updated, and if authentication between the terminal 100 and the medical information management server 400 using a predetermined algorithm (for example, authentication using the above-mentioned My Number card may be performed, or authentication using any algorithm may be performed), is successful, the processing of steps S504 to S506 may be executed for the updated data.

[0078] Figures 6A, 6B, and 6C are explanatory diagrams showing an example of screen transitions of the authority transfer information registration screen displayed on the display device 505 of the computer 500 constituting the terminal 100 in step S309. Figures 6A and 6B are explanatory diagrams showing an example of screen transitions when authority transfer is performed using a standard classification described later. Figure 6C is an explanatory diagram showing an example of screen transitions when authority transfer is performed by individually selecting information.

[0079] An example of the screen transition in Figures 6A and 6B will be described. In step S309, first, screen 601 is displayed. In screen 601, it is possible to select whether to transfer the authority to inquire about some information when the user is unconscious. When "Yes" is selected on screen 601 and the "Next" button is selected, the screen transitions to screen 602. Note that when "No" is selected on screen 601 and the "Next" button is selected, the display of the authority information registration screen ends and authority transfer is not performed, and the data for which authority transfer is set can only be disclosed to the user himself when the user is conscious.

[0080] On screen 602, it is possible to select whether to transfer authority using a predetermined standard classification, or to transfer authority by selecting the type of information. When the character string "See sample" is selected on screen 602, the screen transitions to screen 610 which displays a predetermined standard classification.

[0081] In the example of screen 610 in Fig. 6A, information corresponding to level 1 indicates information that cannot be disclosed without the user's awareness, information corresponding to level 2 indicates information that can be disclosed only when the disclosure conditions are met (even if the user is unconscious), and information corresponding to level 3 indicates information that can be disclosed (even if the user is unconscious) when the user is in the same place as the paramedic and biometric authentication of the user is successful. As shown in the example of screen 610, information to be disclosed is not limited to medical information and qualification information, but may also include personal information such as bank account and credit card information.

[0082] When authority is transferred using standard classification, (a part of) the disclosure conditions at level 2 are set on screen 604 and subsequent screens. When the "Back" button is selected on screen 610, the screen returns to screen 602.

[0083] When "Transfer authority using standard classification" is selected on screen 602 and the "Next" button is pressed, the screen transitions to screen 603. When the "Back" button is selected on screen 602, the screen returns to screen 601.

[0084] Screen 603 displays an explanation of level 2, the types of information that fall under level 2, and the conditions for disclosing information that fall under level 2. The disclosure conditions displayed on screen 603 indicate that information that falls under level 2 can be disclosed (even if the user is unconscious) to persons who are qualified as paramedics or doctors, or persons to whom the user has registered authority transfer (authority transfer recipients). When the "Back" button is selected on screen 603, the screen returns to screen 602. When the "Next" button is selected on screen 603, the screen transitions to screen 604.

[0085] In the example of screen 603, paramedics and doctors also have the authority to receive disclosure of level 2 information, but it is also possible to prevent paramedics and doctors from having the authority to receive disclosure through input to input device 504 on screen 603 (i.e., to register the transfer of authority only for the authority transfer recipients registered on screen 604).

[0086] Screen 604 is a screen for setting a part of the disclosure conditions for information corresponding to level 2. Specifically, for example, on screen 604, the name and address of the authority transferee and the relationship with the user (these are examples of information for identifying the authority transferee) are registered. Note that the pronunciation of the authority transferee's name (for example, the phonetic symbols of the name, or the kana name in Japanese) may also be registered. Similarly, the pronunciation of the user's name may be registered in wallet 221 of user information management server 200, and the pronunciation of the paramedic's name may be registered in wallet 321 of paramedic information management server 300.

[0087] When the "Back" button is selected on the screen 604, the screen returns to the screen 603. When the "Register" button is selected on the screen 604, the screen transitions to the screen 605.

[0088] Screen 605 is a screen for registering biometric information of the other party to whom authority is to be transferred. For example, when transitioning to screen 605, a camera, which is an example of biometric sensor 507 of computer 500 constituting terminal 100, is started, and it becomes possible to photograph the face of the other party to whom authority is to be transferred. When the "Back" button is selected on screen 605, the screen returns to screen 604. When the "Photograph" button is selected on screen 605, a photograph is taken by the camera, and then the screen transitions to screen 606.

[0089] On screen 606, the information of the authority transfer partner input via screen 604 and the image captured by the camera via screen 605 are displayed as confirmation information for the authority transfer settings. When the "Back" button is selected on screen 606, the screen returns to screen 605. When the "Confirm" button is selected on screen 606, the screen transitions to screen 6061.

[0090] Screen 6061 is a final confirmation screen for the authority transfer. When the "Cancel" button is selected on screen 6061, the screen returns to screen 606. When the "Register" button is selected on screen 6061, authority transfer information is transmitted in step S310, and when the registration result is notified in step S312, the screen transitions to screen 607 as a registration result notification screen. Note that screens 605, 606, and 6061 may be displayed on the terminal 100 owned by the authority transfer partner.

[0091] Note that the biometric information of the authority transfer partner itself is not registered in the wallet 221, and instead, for example, a feature (of the authority transfer partner's biometric information) generated from the authority transfer partner's biometric information by a predetermined algorithm may be registered, or, to further enhance security, a public key certificate generated from the authority transfer partner's biometric information in a manner similar to steps S304 to S305 may be registered. Furthermore, when the "Register" button is selected on the screen 6061, a biometric signature based on the authority transfer partner's biometric information is generated by a predetermined algorithm, thereby indicating consent to the authority transfer information being registered in the wallet 221.

[0092] In addition, instead of authentication using biometric information, authentication using another authentication means (for example, password authentication or device authentication (for example, a one-time password is sent to a pre-registered smartphone or the like other than the terminal 100 of the person to be authenticated, and the transmitted one-time password is entered into the terminal 100 to authenticate that the person to be authenticated is the person who owns the pre-registered smartphone or the like)) may be performed for the person to whom authority is transferred.

[0093] When the "End" button is selected on screen 607, the processing of steps S309 to S312 ends. When the "Additional Registration" button is selected on screen 607, the screen returns to screen 604 (however, if a transition is made between screens 6031 and 6041 described below, it is advisable to return to screen 6041), and information on further parties to whom authority can be transferred can be registered.

[0094] Next, an example of screen transition in Fig. 6C will be described. When "select information individually and transfer authority" is selected on the screen 602 and the "Next" button is selected, a transition to a screen 6031 occurs.

[0095] Screen 6031 displays check boxes showing options for selecting which information corresponds to level 2. In addition, when the words "Select from wallet" are selected on screen 6031, a list of data indexes stored in wallet 221 is displayed, and information to be assigned to level 2 can be selected from the list of data indexes.

[0096] When the "Back" button is selected on screen 6031, the screen returns to screen 602. When the "Next" button is selected on screen 6031, the information selected in the check boxes is selected as information corresponding to level 2, and the screen transitions to screen 6041. Note that when the "Next" button is selected on screen 6031, a confirmation screen is displayed displaying a list of information selected in the check boxes and a "Confirm" button, and when the "Confirm" button is selected on the confirmation screen, the screen transitions to screen 6041.

[0097] Screen 6041 is a screen for setting a part of the disclosure conditions of the information selected as corresponding to level 2 on screen 6031. Specifically, for example, on screen 604, the name and address of the person to whom authority is to be transferred, and the relationship with the user are registered. Furthermore, when a check box on screen 6041 is selected, the authority to receive the disclosure of the information selected as corresponding to level 2 is not transferred to the paramedic or doctor, but can be transferred only to the person to whom authority is to be transferred. The check box may also be displayed on screen 604. When the "Back" button is selected on screen 6041, the screen returns to screen 6031. When the "Next" button is selected on screen 6041, the screen transitions to screen 605.

[0098] Fig. 7 is a sequence diagram showing an example of information inquiry processing when a user (injured person) is conscious during an emergency. In the example of Fig. 7, an example in which the terminal 100 held by the user is used will be described, but the terminal 100 held by a paramedic may also be used.

[0099] The UID acquisition unit 101 and the PIN acquisition unit 102 of the terminal 100 acquire the UID and the PIN of the user, respectively, via input to the input device 504 of the computer 500 constituting the terminal 100 (S501).

[0100] The data acquisition request unit 108 generates a data index acquisition request including the UID and PIN of the user acquired in step S501 (S702). The data acquisition request unit 108 transmits the data index acquisition request generated in step S702 to the user information management server 200 (S703).

[0101] The data management unit 201 of the user information management server 200 searches for the wallet 221 corresponding to the UID included in the data index acquisition request received in step S703, and the PIN verification unit 202 verifies whether the PIN stored in the searched wallet 221 matches the PIN included in the data index acquisition request received in step S703 (S704). As a result, if the verification is successful, the user information management server 200 can determine that the user is conscious (i.e., the user has consented to the disclosure of information).

[0102] If the PIN is managed by terminal 100, it is verified whether the PIN stored in terminal 100 matches the PIN entered in step S701, and if the verification is successful, the process proceeds to step S702 and subsequent steps. Furthermore, in this case, data acquisition request unit 108 does not include the PIN in the data index acquisition request in S702, and user information management server 200 can determine that PIN verification has been successful by receiving a data index acquisition request including the user's UID.

[0103] If the PIN verification in step S704 is successful, the data management unit 201 of the user information management server 200 obtains a public key certificate and a list of data indexes (which may only contain information of the type indicated by the data index) from the searched wallet 221 (S705).

[0104] The biometric information acquisition unit 103 of the terminal 100 acquires the same type of biometric information as in step S303 via the biometric sensor 507 of the computer 500 constituting the terminal 100 (S706). The key generation unit 104 generates a secret key from the biometric information acquired in step S706 using the same algorithm as in step S304 (S707).

[0105] An authentication process is executed between the terminal 100 and the user information management server 200 (S708). Specifically, the authentication in step S708 is executed by the authentication unit 109 of the terminal 100 using the private key generated in step S707, and by the authentication unit 203 of the user information management server 200 using the public key certificate acquired in step S705. The authentication process in step S708 ensures safety against misrepresentation or input error of the UID from the terminal 100 to the user information management server 200. Note that instead of the authentication using biometric information shown in this embodiment, authentication using another authentication means (for example, password authentication or device authentication) may be executed.

[0106] If auxiliary information is also stored in the wallet 221 searched for in step S704, data management unit 201 also acquires the auxiliary information in step S705 and transmits the acquired auxiliary information to terminal 100 before step S707. In this case, key generation unit 104 of terminal 100 generates a private key in step S707 using the biometric information acquired in step S706 and the received auxiliary information.

[0107] If the authentication in step S708 is successful, the data management unit 201 of the user information management server 200 sends a list of data indexes acquired in step S705 (i.e., data indexes of all the information of levels 1, 2, and 3 mentioned above) to the terminal 100 (S709).

[0108] The data acquisition request unit 108 of the terminal 100 displays the list of data indexes received in step S709 on the display device 505 of the computer 500 constituting the terminal 100, and accepts the selection of a data index corresponding to the data to be acquired via the input device 504 of the computer 500 (S710).

[0109] The data acquisition request unit 108 of the terminal 100 transmits the data index selected in step S710 to the user information management server 200 (S711). The data management unit 201 of the user information management server 200 acquires data corresponding to the data index received in step S711 from the wallet 221 searched for in step S704, and transmits the acquired data to the terminal 100 (S712). As in the example of Fig. 7, when the user information management server 200 is able to confirm that the user is conscious and biometric authentication based on the user's biometric information between the terminal 100 and the user information management server 200 is successful, the terminal 100 can acquire any information stored in the wallet 221 of the user.

[0110] The signature unit 110 of the terminal 100 generates provision consent information, and attaches a signature using the private key generated in step S707 to the data received in step S712 and the generated provision consent information (S713). Note that if the qualification information and medical information stored in the wallet 221 are encrypted with the public key generated in step S304, the data acquisition request unit 108 decrypts the data received in step S712 with the private key generated in step S707.

[0111] The provision consent information generated in step S713 includes, for example, a hash value of the data received in step S712, user information, verifier information (for example, the Fire and Disaster Management Agency, administrators of each server included in the information inquiry system, administrators of the entire information inquiry system, the user's family, and lawyers and other people who may check the operation of paramedics are all examples of verifiers), date and time, and the purpose of use of the provided data. The signature added in step S713 is information that proves to the verifier that the user has agreed to presenting the data. By adding the signature in step S713, the verifier can prove to a third party that the data received in step S712 was not obtained illegally and that the data is not being used for any other purpose.

[0112] When the process of step S713 is completed, the signed data and the provision consent information are displayed on the display device 505 of the computer 500 constituting the terminal 100. The key generation unit 104 deletes the private key generated in step S707 (S714).

[0113] 8A and 8B are sequence diagrams showing an example of information inquiry processing when a user (injured person) is unconscious during an emergency. In the example of Fig. 8A and 8B, either the terminal 100 held by the user or the terminal 100 held by the paramedic may be used, but the same terminal is used for processing related to the paramedic and processing related to the user.

[0114] The UID acquisition unit 101 of the terminal 100 acquires the UID of the paramedic via an input to the input device 504 of the computer 500 constituting the terminal 100 (S801). The data acquisition request unit 108 generates a public key certificate acquisition request including the UID of the paramedic acquired in step S801 (S802), and transmits the generated public key certificate acquisition request to the paramedic information management server 300 (S803).

[0115] The data management unit 301 of the paramedic information management server 300 searches for the wallet 321 corresponding to the UID of the paramedic included in the public key certificate acquisition request received in step S803, and acquires the public key certificate from the searched wallet 321 (S804).

[0116] In addition, if the paramedic's PIN is registered, the paramedic's PIN is obtained in addition to the paramedic's UID, and the obtained PIN is included in the public key certificate acquisition request. The paramedic information management server 300 obtains the public key certificate in step S804 only if the PIN stored in the searched wallet 321 matches the PIN included in the public key certificate acquisition request.

[0117] The biometric information acquisition unit 103 of the terminal 100 acquires the same type of biometric information as in step S402 via the biometric sensor 507 of the computer 500 constituting the terminal 100 (S805). The key generation unit 104 generates a secret key from the biometric information acquired in step S805 using the same algorithm as in step S403 (S806).

[0118] An authentication process (i.e., confirmation of authority as a paramedic) is executed between the terminal 100 and the paramedic information management server 300 (S807). Specifically, the authentication in step S807 is executed by the authentication unit 109 of the terminal 100 using the private key generated in step S806, and the authentication unit 302 of the paramedic information management server 300 using the public key certificate acquired in step S804. The authentication process in step S807 ensures safety against misrepresentation or input error of the UID from the terminal 100 to the paramedic information management server 300. Note that instead of the authentication using biometric information shown in this embodiment, authentication using another authentication means (for example, password authentication or device authentication) may be executed.

[0119] If auxiliary information is also stored in wallet 321 searched for in step S804, data management unit 301 also acquires the auxiliary information in step S804 and transmits the acquired auxiliary information to terminal 100 before step S806. In this case, key generation unit 104 of terminal 100 generates a private key in step S806 using the biometric information acquired in step S805 and the received auxiliary information.

[0120] If the authentication in step S807 is successful, the biometric information acquisition unit 103 of the terminal 100 acquires the biometric information of the user (S808) (for example, through an operation by a paramedic since the user is unconscious). The key generation unit 104 generates a private key from the biometric information acquired in step S808 (S809). The processes in steps S808 and S809 are similar to those in steps S706 and S707, respectively.

[0121] An authentication process is executed between the terminal 100 and the user information management server 200 (S810). The process of step S810 is similar to the process of step S708, but in the process of Fig. 8A, the user is not aware and the user's UID cannot be obtained, so 1:N authentication is performed. That is, authentication is performed using the private key generated in step S809 and the public key certificates in all wallets 221 held by the user information management server 200, and if authentication using the private key and the public key certificate in one wallet 221 is successful, it is determined that the authentication in step S810 is successful.

[0122] Unlike the example in Figure 7, authentication in step S810 is performed without sending the user's UID and PIN to the user information management server 200 (without determining that the user's PIN has been successfully verified), allowing the user information management server 200 to determine that the user is unconscious.

[0123] Since the biometric information of the paramedic in step S805 and the biometric information of the user in step S808 are acquired by the same terminal 100, it is guaranteed that the paramedic and the user are in the same location, thereby preventing the paramedic from illegally acquiring the user's information.

[0124] If the authentication in step S810 is successful, the data management unit 201 of the user information management server 200 sends the user's UID and authority transfer information stored in the wallet 221 corresponding to the successfully authenticated public key certificate to the terminal 100 (S811).

[0125] The data acquisition request unit 108 of the terminal 100 displays information indicating the authority transfer contents on the display device 505 of the computer 500 constituting the terminal 100 based on the authority transfer information received in step S811, thereby allowing the paramedic to confirm the authority transfer registration contents (S812). Also, in step S812, the data acquisition request unit 108 can execute authority transfer based on the authority transfer registration contents via input to the input device 504 of the computer 500 constituting the terminal 100.

[0126] The data acquisition request unit 108 transmits a data index list acquisition request including the user UID received in step S811 and information indicating the authority transferred in step S812 to the user information management server 200 (S813).

[0127] The data management unit 201 of the user information management server 200 searches for a wallet 221 corresponding to the UID included in the data index acquisition request received in step S813, and acquires a list of data indexes (which may only contain information of the type indicated by the data index) from the searched wallet 221 (S814).

[0128] However, the list of data indexes acquired in step S814 consists of data indexes of data that can be disclosed if the user is in the same location as the paramedic and authentication based on the user's biometric information is successful (information corresponding to level 3 in the example described above), and data indexes of data corresponding to the transferred authority indicated in the data index list acquisition request received in step S813.

[0129] The data management unit 201 transmits the list of data indexes acquired in step S814 to the terminal 100 (S815). The data acquisition request unit 108 of the terminal 100 displays the list of data indexes received in step S815 on the display device 505 of the computer 500 constituting the terminal 100, and accepts selection of a data index corresponding to the data to be acquired via the input device 504 of the computer 500 (S816).

[0130] The data acquisition request unit 108 of the terminal 100 transmits the data index selected in step S816 to the user information management server 200 (S817). The data management unit 201 of the user information management server 200 acquires data corresponding to the data index received in step S817 from the wallet 221 searched for in step S814, and transmits the acquired data to the terminal 100 (S818).

[0131] In addition, data that can be disclosed if the user is in the same location as the paramedic and authentication based on the user's biometric information is successful (information corresponding to level 3 in the example described above) may be transmitted in step S811 (it is guaranteed that the disclosure conditions for level 3 are met in the processing of steps S805 to S810) and displayed on display device 505 of computer 500 constituting terminal 100 in step S812.

[0132] The signature unit 110 of the terminal 100 generates provision consent information and attaches a signature using the private key generated in step S806 to the data received in step S818 and the generated provision consent information (S819). Note that the processing of step S819 may be omitted. Note that, if the qualification information and medical information stored in the wallet 221 are encrypted with the public key generated in step S304, the data acquisition request unit 108 decrypts the data received in step S818 with the private key generated in step S809.

[0133] The provision consent information generated in step S819 is information including, for example, a hash value of the data received in step S818, information about the paramedic, information about the verifier, date and time, and the purpose of use of the provided data. The signature added in step S819 is information that proves to the verifier that authority has been transferred to the paramedic with the prior consent of the user and that the data has been presented to the paramedic. By adding the signature in step S819, the verifier can prove to a third party that the data received in step S818 has not been obtained illegally and that the data has not been used for any other purpose.

[0134] When the processing of step S819 is completed, the signed data and the provision consent information are displayed on the display device 505 of the computer 500 constituting the terminal 100. However, if the processing of step S819 is omitted, when the processing of step S818 is completed, the received data is displayed on the display device 505 of the computer 500 constituting the terminal 100. The key generation unit 104 deletes the private key generated in step S806 (S820), and deletes the private key generated in step S809 (S821).

[0135] 9A and 9B are explanatory diagrams showing an example of screen transition of an authority transfer registration content confirmation screen displayed on the display device 505 of the computer 500 constituting the terminal 100 in steps S805 to S812. Fig. 9C is an explanatory diagram showing an example of screen transition of an information presentation consent screen displayed on the display device 505 of the computer 500 constituting the terminal 100 in step S812.

[0136] The authority transfer registration content confirmation screen shown in Figures 9A and 9B is displayed on the terminal 100 (terminal 100 of the paramedic or user) shown in Figures 8A and 8B. The information presentation consent screen shown in Figure 9C is desirably displayed on the terminal 100 of the authority transfer partner so that the authority transfer partner can consent to information disclosure even if he / she is not in the same place as the paramedic and the user. However, in cases where the authority transfer partner is in the same place as the paramedic and the user, etc., the screen may be displayed on the terminal 100 shown in Figures 8A and 8B.

[0137] In step S805, first, screen 901 is displayed. Screen 901 is a screen for acquiring biometric information of the paramedic to verify his / her qualifications. When screen 901 is displayed, a camera, which is an example of biometric sensor 507 of computer 500 constituting terminal 100, is started, and the face of the paramedic can be photographed. When the "Photograph" button is selected on screen 901, photographing is performed by the camera (processing of step S805), and processing of steps S806 and S807 is performed. If authentication in step S807 is successful, the screen transitions to screen 902.

[0138] Screen 902 displays the result of the qualification confirmation (for example, information obtained from wallet 321, such as the name and qualifications of the paramedic). When the "Back" button is selected on screen 902, the screen returns to screen 901. When the "Register" button is selected on screen 902, the screen transitions to screen 903.

[0139] Screen 903 is a screen for acquiring biometric information of a user (injured person). When screen 903 is displayed, a camera, which is an example of biometric sensor 507 of computer 500 constituting terminal 100, is started up, and the face of the user can be photographed.

[0140] When the "Back" button is selected on screen 903, the screen returns to screen 902. When the "Photograph" button is selected on screen 903, photographing is performed by the camera (processing of step S808), and the processes of steps S809 and S810 are performed. If the authentication of step S810 is successful, the process of step S811 is performed, and then the screen transitions to screen 904.

[0141] Screen 904 is a screen displayed in step S812, and displays authority transfer information. In the example of screen 904, the user's name (Hitachi Itsuki) and allergy information (the text "Allergy information is not registered.") are data that can be disclosed (corresponding to the above-mentioned level 3 information) when the user is in the same location as the paramedic and biometric authentication of the user is successful.

[0142] Furthermore, the example of screen 904 shows that there is data (corresponding to the above-mentioned level 2 information) for which the authority to receive disclosure can be transferred to a "paramedic", a "doctor", and the user's family members "Hitachi Taro" and "Hitachi Jiro". In the examples of Figures 8A and 8B, the paramedic is operating terminal 100, and since the authority to disclose the data can be transferred to the paramedic, the paramedic (who has already been successfully authenticated in step S807) can operate the "Agree" button to disclose this data.

[0143] When the “Agree” button is selected on screen 904, the user's UID and authority information indicating disclosure by the paramedic are sent in step S813, and processing of steps S814 to S819 is executed (FIG. 9A does not show the screen for selecting a data index from the list of data indexes in step S816), and the screen transitions to screen 905.

[0144] The data received in step S818 is displayed on screen 905. When the "Back" button is selected on screen 905, the screen returns to screen 904. When the "Exit" button is selected on screen 905, the authority transfer registration content confirmation screen is closed.

[0145] 9B is a screen displayed in place of screen 904 when the disclosure conditions for information corresponding to level 2 indicate that authority has not been delegated to the paramedic, but there is a person to whom authority has been delegated, such as a family member, set by the user. Like screen 904, screen 9041 displays data that can be disclosed when the user is in the same place as the paramedic and biometric authentication of the user is successful.

[0146] Screen 9041 also shows that there is data (corresponding to the above-mentioned level 2 information) for which the authority to receive disclosure can be transferred to the user's family members "Hitachi Taro" and "Hitachi Jiro" (i.e., these two are the pre-registered authority transfer recipients). Note that screen 9041 may display a list of data indexes of data to be disclosed when the authority transfer recipients give consent to the information presentation.

[0147] When at least one check box corresponding to the authority transfer partner is selected and then the "Contact" button is selected, the information presentation consent screen of FIG. 9C is launched on the terminal 100 of the authority transfer partner.

[0148] 9C, information indicating that the user has requested the authority transferee to disclose information and information about the paramedic are displayed. When the “Next” button is selected on screen 906, the screen transitions to screen 907.

[0149] Screen 907 is a screen for acquiring biometric information (biometric information of the type registered via screen 606) of the authority transfer partner (a screen for acquiring information necessary for authentication). When screen 907 is displayed, a camera, which is an example of biometric sensor 507 of computer 500 constituting terminal 100, is started up, and it becomes possible to capture an image of the face of the authority transfer partner. When the "Back" button is selected on screen 907, the screen returns to screen 906. When the "Authentication" button is selected on screen 907, an image is captured by the camera, and the authority transfer partner is authenticated using the captured image, and if the authentication is successful, the screen transitions to screen 9071.

[0150] Screen 9071 is a final confirmation screen for consenting to information disclosure. When the "Cancel" button is selected on screen 9071, the screen returns to screen 907. When the "Agree" button is selected on screen 9071, the UID of the user and authority information indicating disclosure by the authority transfer partner are transmitted in step S813, and the processing of steps S814 to S819 is executed (illustration of the screen for selecting a data index from the list of data indexes in step S816 is omitted in FIG. 9A), and further, screen 9041 of terminal 100 of the paramedic transitions to screen 9051, and screen 9071 of the authority transfer partner transitions to screen 908.

[0151] A display indicating that authentication of the authority transfer partner and information disclosure are completed is displayed on screen 908. When the "End" button is selected on screen 908, the information presentation consent screen on terminal 100 of the authority transfer partner is closed.

[0152] 9B, the data received in step S818 and information on the authority transfer partner as an approver are displayed. When the "Back" button is selected on screen 9051, the screen returns to screen 9041. When the "Exit" button is selected on screen 905, the authority transfer registration content confirmation screen is closed.

[0153] In addition, if consent to disclosure is not obtained from the authority transfer partner even after a predetermined time has elapsed since the "Contact" button on screen 9041 was selected (since an instruction to display screen 9071 was output), some or all of the information corresponding to level 2 may be disclosed to the terminal 100 of the paramedic. The type of data to be disclosed if consent to disclosure is not obtained from the authority transfer partner even after a predetermined time has elapsed since the "Contact" button on screen 9041 was selected may be, for example, predetermined or may be set by the user when registering the authority transfer information. This allows the paramedic to obtain information necessary for lifesaving even in a situation where the authority transfer partner is unable to check the terminal 100.

[0154] As described above, in the information inquiry system of this embodiment, the user's medical information, qualification information, etc. are stored in advance in the user information management server 200, and this information can be queried using authentication based on biometric information between the terminal 100 and the user information management server 200 when the user is transported to emergency care. Therefore, even if the user does not have an official identification card when the user is transported to emergency care, the user's identity can be confirmed from the user's biometric information, and the queried medical information and qualification information can be used to speed up the emergency medical technician's decision on first aid and the selection of the medical institution to which the user should be transported.

[0155] Furthermore, in the user information registration process, the information inquiry system registers prior consent to transfer of authority to receive data disclosure to a paramedic, family member, etc., so that even if the user is unconscious when the user is transported by ambulance, the information inquiry system can inquire about medical information and qualification information after confirming the user's identity and intention to transfer authority from the user's biometric information. In particular, when the user is unconscious, biometric authentication of the paramedic and the user is performed using the same terminal 100, so it is guaranteed that the paramedic and the user are in the same place, which in turn suppresses unauthorized inquiries about medical information and qualification information.

[0156] In addition, the information inquiry system allows the disclosure conditions for authority transfer (such as the user's symptoms and the person to whom the authority is to be transferred) to be registered in advance during the user information registration process, making it possible to disclose information based on the user's own wishes.

[0157] In addition, during the information inquiry process, the information inquiry system cannot access the user information management server 200 or disclose information unless biometric information is presented by the user and, if necessary, the paramedic and / or the person to whom authority has been transferred, thereby preventing the accidental disclosure of medical information, qualification information, etc. to other people or unauthorized persons.

[0158] In addition, during the information inquiry process, the information inquiry system can later verify that the information has been disclosed with the consent of the user or paramedic by signing the data sent from the user information management server 200 with a private key generated from the biometric information.

[0159] In addition, the information inquiry system of this embodiment can be applied not only to emergency transport, but also to identity confirmation when property has been lost in natural disasters such as earthquakes and floods, as well as to inquiries about medical information and information on various contracted services such as banks.

[0160] The present invention is not limited to the above-mentioned embodiment, and various modifications are included. For example, the above-mentioned embodiment has been described in detail to clearly explain the present invention, and is not necessarily limited to those having all the configurations described. It is also possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. It is also possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.

[0161] In addition, the above-mentioned configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. In addition, the above-mentioned configurations, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information such as the program, table, file, etc. that realizes each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

[0162] In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and not all control lines and information lines in the product are necessarily shown. In reality, it can be considered that almost all components are connected to each other. [Explanation of symbols]

[0163] 100 terminal, 101 UID acquisition unit, 102 PIN acquisition unit, 103 biometric information acquisition unit, 104 key generation unit, 105 public key certificate generation unit, 106 registration request unit, 107 authority transfer registration unit, 108 data acquisition request unit 108, 109 authentication unit 109, 110 signature unit, 200 user information management server, 201 data management unit, 202 PIN verification unit, 203 authentication unit, 221 wallet, 300 paramedic information management server, 301 data management unit, 302 authentication unit, 321 wallet, 500 computer, 501 CPU 501, 502 memory, 503 auxiliary storage device, 504 input device, 505 display device, 506 communication device, 507 biometric sensor, 508 IC card reader

Claims

1. An information inquiry system including a terminal and a server, The server holds information to be disclosed of the user and authority information indicating an authority to receive disclosure of each type of information to be disclosed according to whether or not the user is aware of the information, The terminal includes: Acquire first biometric information of the user; Acquire second biometric information of the representative; The server, receiving from the terminal a data acquisition request based on consciousness confirmation information indicating that the user is conscious, determining that verification of the consciousness confirmation information has been successful based on the data acquisition request, and when determining that first biometric authentication of the user based on the first biometric information between the terminal and the server has been successful, transmitting to the terminal information included in the disclosure target information, the information being authorized to be disclosed when the user is conscious, as indicated by the authority information; An information inquiry system that, when it is determined that the first biometric authentication and the second biometric authentication of the representative based on the second biometric information between the terminal and the server are successful without determining that the verification of the consciousness confirmation information is successful, transmits to the terminal information included in the information to be disclosed, which information is authorized to be disclosed in the event of the user's unconsciousness, as indicated by the authority information.

2. The information inquiry system according to claim 1, The authority information is First type information is information that can be disclosed only with the user's consent; Second-type information is information that can be disclosed even without the user's consciousness when a disclosure condition based on the user's symptoms and / or a party to whom the authority is transferred is satisfied; and and a third type of information that can be disclosed when the first biometric authentication and the second biometric authentication are successful using the same terminal, even without the user's awareness.

3. 3. The information inquiry system according to claim 2, The disclosure condition indicates that authentication of the authority transfer party, including the agent, is successful; An information inquiry system in which the server transmits the second type of information included in the information to be disclosed to the terminal when it determines that the first biometric authentication and the second biometric authentication are successful without determining that the verification of the consciousness confirmation information is successful.

4. 3. The information inquiry system according to claim 2, The disclosure condition indicates that authentication of the authority transfer partner different from the agent is successful, The terminal acquires authentication information at the time of inquiry of the authority transfer partner, between the terminal and the server, authentication of the authority transfer partner is performed based on the inquiry authentication information; An information inquiry system in which the server transmits the second type of information included in the information to be disclosed to the terminal when it determines that the first biometric authentication, the second biometric authentication, and the authentication of the party to whom authority is to be transferred are successful without determining that the verification of the consciousness confirmation information is successful.

5. The information inquiry system according to claim 4, The terminal includes: An input device and a display device, displaying on the display device information for identifying the authority transfer partner and a first screen for acquiring registration time authentication information of the authority transfer partner via the input device; Transmitting information for identifying the authority transferee and the registration authentication information to the server; An information inquiry system, wherein authentication of the party to whom the authority is to be transferred is performed based on the inquiry authentication information and the registration authentication information.

6. The information inquiry system according to claim 4, The authority information includes information for identifying the authority transfer partner and registration authentication information of the authority transfer partner, The terminal has an input device and a display device, When the server determines that the first biometric authentication and the second biometric authentication are successful without determining that the verification of the consciousness confirmation information is successful, the terminal displays, on the display device, a second screen for displaying information for identifying the authority transfer partner, and a third screen for acquiring the inquiry authentication information via the input device; An information inquiry system, wherein authentication of the party to whom the authority is to be transferred is performed based on the inquiry authentication information and the registration authentication information.

7. 7. The information inquiry system according to claim 6, An information inquiry system in which, if authentication of the authority transfer recipient is not completed within a predetermined time after the terminal displays the third screen, the server omits authentication of the authority transfer recipient and transmits the second type of information included in the information to be disclosed to the terminal.

8. 3. The information inquiry system according to claim 2, The terminal has a display device and an input device, the server receives the data acquisition request from the terminal, and when determining that the verification of the consciousness confirmation information is successful based on the data acquisition request and that the first biometric authentication is successful, transmits to the terminal a list of indexes indicating the types of the disclosure target information corresponding to each of the first type information, the second type information, and the third type information; The terminal includes: displaying a list of the indexes on the display device; accepting a selection of an index corresponding to information to be transmitted from the list of indexes via an input to the input device; Sending the selected index to the server; The server transmits to the terminal the disclosure target information corresponding to the index transmitted from the terminal.

9. The information inquiry system according to claim 1, The terminal includes: A display device and an input device are included, An information inquiry system that displays on the display device a screen for accepting settings of the information to be disclosed when the user is conscious and the information to be disclosed even when the user is unconscious, via input to the input device.

10. The information inquiry system according to claim 1, The server, a first public key certificate corresponding to a public key of a key pair consisting of a private key and a public key generated from the user's first biometric information at the time of registration; a second public key certificate corresponding to the public key of a key pair consisting of a private key and a public key generated from the second biometric information at the time of registration of the representative; The terminal includes: generating a first private key from the first biometric information; generating a second private key from the second biometric information; the first biometric authentication is performed by the terminal using the first private key and by the server using the first public key certificate; An information query system, wherein the second biometric authentication is performed by the terminal using the second private key and by the server using the second public key certificate.

11. The information inquiry system according to claim 10, the disclosure target information held by the server is encrypted with a public key generated from the first enrollment time biometric information, The server decrypts the information included in the disclosure target information transmitted from the terminal using the second private key.

12. The information inquiry system according to claim 10, The server affixes a signature using the first private key to information included in the disclosure target information transmitted from the terminal.

13. An information inquiry method by an information inquiry system including a terminal and a server, The server holds information to be disclosed of the user and authority information indicating an authority to receive disclosure of each type of information to be disclosed according to whether or not the user is aware of the information, The information inquiry method includes: The terminal acquires first biometric information of the user, The terminal acquires second biometric information of the agent, when the server receives from the terminal a data acquisition request based on consciousness confirmation information indicating that the user is conscious, and determines that verification of the consciousness confirmation information is successful based on the data acquisition request, and determines that first biometric authentication of the user based on the first biometric information between the terminal and the server is successful, transmits to the terminal information included in the disclosure target information, the information being authorized to be disclosed when the user is conscious, as indicated by the authority information; An information inquiry method in which, when the server determines that the first biometric authentication and the second biometric authentication of the representative based on the second biometric information between the terminal and the server are successful without determining that the verification of the consciousness confirmation information is successful, the server transmits to the terminal information included in the information to be disclosed, the information being information that the user has the authority to disclose in the event of his or her unconsciousness, as indicated by the authority information.

Images